password removed from index.php